strip_harmful_tags: remove data- attributes

[tt-rss.git] / include / functions.php

diff --git a/include/functions.php b/include/functions.php
index 1dd9a7a1cc7fd106d5d7a5130bac9612600fe9a6..9125df3bd8a367cd65cca22d4be2596d67cc77b1 100755 (executable)
--- a/include/functions.php
+++ b/include/functions.php
@@ -1761,6 +1761,10 @@
                                                array_push($attrs_to_remove, $attr);
                                        }
 
+                                       if (strpos($attr->nodeName, "data-") === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                        if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
                                                array_push($attrs_to_remove, $attr);
                                        }